CVE-2006-1292 | BDVDB-2026-15768 Detail

Description#

Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12006-03-19Record published in the CVE List.
2. Version 22024-08-07Most recent update recorded in the CVE List.